1 files changed, 11 insertions, 2 deletions

diff --git a/noncore/unsupported/qpdf/xpdf/Function.cc b/noncore/unsupported/qpdf/xpdf/Function.cc
index 815cc89..ebf3718 100644
--- a/noncore/unsupported/qpdf/xpdf/Function.cc
+++ b/noncore/unsupported/qpdf/xpdf/Function.cc
@@ -1,17 +1,17 @@
 //========================================================================
 //
 // Function.cc
 //
-// Copyright 2001 Derek B. Noonburg
+// Copyright 2001-2002 Glyph & Cog, LLC
 //
 //========================================================================
 
 #ifdef __GNUC__
 #pragma implementation
 #endif
 
 #include <aconf.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
 #include <math.h>
@@ -406,89 +406,98 @@ void SampledFunction::transform(fouble *in, fouble *out) {
 }
 
 //------------------------------------------------------------------------
 // ExponentialFunction
 //------------------------------------------------------------------------
 
 ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
   Object obj1, obj2;
   GBool hasN;
   int i;
 
   ok = gFalse;
-  hasN = gFalse;
 
   //----- initialize the generic stuff
   if (!init(dict)) {
     goto err1;
   }
   if (m != 1) {
     error(-1, "Exponential function with more than one input");
     goto err1;
   }
+  hasN = hasRange;
 
   //----- default values
   for (i = 0; i < funcMaxOutputs; ++i) {
     c0[i] = 0;
     c1[i] = 1;
   }
 
   //----- C0
   if (dict->lookup("C0", &obj1)->isArray()) {
     if (!hasN) {
       n = obj1.arrayGetLength();
+      hasN = gTrue;
     } else if (obj1.arrayGetLength() != n) {
       error(-1, "Function's C0 array is wrong length");
       goto err2;
     }
     for (i = 0; i < n; ++i) {
       obj1.arrayGet(i, &obj2);
       if (!obj2.isNum()) {
 	error(-1, "Illegal value in function C0 array");
 	goto err3;
       }
       c0[i] = obj2.getNum();
       obj2.free();
     }
   }
   obj1.free();
 
   //----- C1
   if (dict->lookup("C1", &obj1)->isArray()) {
     if (!hasN) {
       n = obj1.arrayGetLength();
+      hasN = gTrue;
     } else if (obj1.arrayGetLength() != n) {
       error(-1, "Function's C1 array is wrong length");
       goto err2;
     }
     for (i = 0; i < n; ++i) {
       obj1.arrayGet(i, &obj2);
       if (!obj2.isNum()) {
 	error(-1, "Illegal value in function C1 array");
 	goto err3;
       }
       c1[i] = obj2.getNum();
       obj2.free();
     }
   }
   obj1.free();
 
   //----- N (exponent)
   if (!dict->lookup("N", &obj1)->isNum()) {
     error(-1, "Function has missing or invalid N");
     goto err2;
   }
   e = obj1.getNum();
   obj1.free();
 
+  // this isn't supposed to happen, but I've run into (broken) PDF
+  // files where it does
+  if (!hasN) {
+    error(-1, "Exponential function does not define number of output values");
+    n = 1;
+  }
+
   ok = gTrue;
   return;
 
  err3:
   obj2.free();
  err2:
   obj1.free();
  err1:
   return;
 }
 
 ExponentialFunction::~ExponentialFunction() {